YesWiki: SQL injection in Bazar entry creation via date_maj_fiche
Summary
YesWiki versions from 4.5.0 up to, but not including, 4.7.0 contain an SQL injection in the creation of Bazar entries. The date_maj_fiche field is inserted unescaped into an INSERT statement in PageManager::save(). On a default installation, an unauthenticated attacker can read data from the database, such as password hashes of wiki users, which may enable offline cracking and takeover of administrator accounts. The attack requires no account and no user interaction.
Affected
- YesWiki 4.5.0 up to, but not including, 4.7.0
- VulDB lists the range as 4.5.0 to 4.6.x
Fixed in
- Fixed in YesWiki 4.7.0 (according to the GitHub advisory GHSA-wjf7-hrf3-9gcx)
Workaround
Unknown. The vendor advisory does not describe a workaround.
- VulDB suggests limiting Bazar entry-creation endpoints to authenticated users. This may break public forms, so test it first.
- VulDB suggests WAF rules for SQL injection patterns as a temporary measure only. They are not a substitute for patching.
Exploitation
- CVSS v4.0 score 8.8; NVD status Deferred.
- CISA SSVC lists exploitation as 'poc' and automatable as yes.
- ThehackerWire reports no confirmed public exploit code at this time.
- Not listed in the CISA KEV catalogue according to research notes; not checked directly.
Our recommendation
- Inventory all YesWiki instances and their versions.
- Upgrade every installation from 4.5.0 up to 4.7.0 to version 4.7.0 or later.
- Until the upgrade is done, restrict or disable public Bazar entry creation where possible.
- Review database and user logs for unusual Bazar submissions.
- If compromise is suspected, rotate wiki user passwords and any credentials reused elsewhere.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-wjf7-hrf3-9gcx github.com
- VulnCheck advisory for CVE-2026-116211 www.vulncheck.com
- VulDB CVE-2026-116211 vuldb.com
- VulDB vulnerability 426263 vuldb.com
- OpenCVE CVE-2026-116211 app.opencve.io
- ThehackerWire CVE-2026-116211 www.thehackerwire.com
- Related advisory GHSA-hgxv-w4r8-8877 github.com
- YesWiki release v4.6.7 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:35.
Original description (NVD)
YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki_users to exfiltrate password hashes.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.